Delete observables

You can choose to remove, delete, or ignore observables that are no longer necessary or relevant.

Remove observables

You can remove observables related to an entity when they add no intelligence value, or when they introduce unwanted data noise.
When you remove an observable, the Intelligence Center deletes any existing relationships between the observable and the entity.
The observable remains stored in the database. However, it no longer has any relationships with the entity it referred to. Therefore, it is no longer displayed in the Observables tab in the entity detail pane.

To remove an observable related to an entity:

1. In the entity detail pane, click the Observables tab.

2. Click the menu icon in the row corresponding to the observable you want to remove from the entity.

   On the row corresponding to the observable you want to ignore, click the dotted menu icon.

3. From the drop-down menu select Remove from entity.

4. You are not prompted to confirm the action, which is executed immediately.
   A notification message informs you about the outcome of the operation.

Delete observables

If you delete an observable from the Intelligence Center, it may return again as a result of an upload, manual creation, or through a feed. To be completely sure an observable disappears from view, you need to tell the Intelligence Center to ignore it too. Consequently, the Intelligence Center offers two options for deleting observables: Delete and Delete and ignore.

When you delete and ignore an observable, the Intelligence Center:

• deletes the specified observable from the database.

• creates an ignore rule for the selected observable to prevent it from re-appearing in the future.

Delete from a graph

To delete observables from a graph:

1. Select the observable concerned, or drag your cursor over several observables to select them all

2. Right-click the observable or one of the observables in the group.

3. Select Delete from the platform.

Delete from Browse and Production

To delete an observable in the Browse or the Production views:

1. In the left navigation bar, go to Search > GO TO SEARCH AND BROWSE > Observables.

2. In the active view, browse to the observable you want, click the menu icon , and from the drop-down menu select Delete or Delete and ignore.
   Alternatively:
   Click the observable you want to delete to open the corresponding detail pane.
   In the detail pane, click the menu icon , and from the drop-down menu select Delete or Delete and ignore

3. In the confirmation dialog, click Delete or Delete and ignore respectively.

Bulk delete observables

You can also bulk delete observables:

1. In the active view, select the checkboxes corresponding to all the observables you want to delete.
   A counter above the table header displays the total amount of selected objects.

2. Click the menu icon above the table header, and from the drop-down menu , click Delete or Delete and ignore.

3. In the confirmation dialog, click Delete or Delete and ignore respectively.